Stored Cross-Site Scripting Vulnerability in Sydney Toolbox Plugin for WordPress

CVE-2024-1447

What is CVE-2024-1447?

The Sydney Toolbox plugin for WordPress is exposed to Stored Cross-Site Scripting vulnerabilities due to inadequate sanitization of user inputs in the aThemes Slider button element. This issue affects all versions up to and including 1.25, enabling authenticated attackers with contributor-level permissions or higher to embed malicious web scripts. When users access pages that include these injected scripts, they may unknowingly execute harmful code, jeopardizing site integrity and user data.

References